The vulnerability CVE-2025-28975 affects the Alike - WordPress Custom Post Comparison plugin by redqteam, specifically versions up to 3.0.1. It is a reflected cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a victim interacts with crafted content, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed as no official patch or vendor advisory is provided. Users of the affected plugin should monitor the vendor's channels for updates or official fixes. Until a patch is available, consider disabling or removing the plugin if feasible to mitigate risk. Avoid interacting with untrusted links or inputs that may trigger the vulnerability.